{"answers":{"affected":"2 open source packages ship an affected version, including sgx-dcap-quote-verify-python.","exploited":"There is no known exploitation of GHSA-344m-qcjq-xgrf in the wild and no public exploit code.","fix":"Upgrade sgx-dcap-quote-verify-python to 0.0.3 or later.","what":"GHSA-344m-qcjq-xgrf is a memory corruption vulnerability in sgx-dcap-quote-verify-python, published on 14 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-344m-qcjq-xgrf and fix it if it is affected.\n\nWhat it is: GHSA-344m-qcjq-xgrf is a memory corruption vulnerability in sgx-dcap-quote-verify-python, published on 14 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-344m-qcjq-xgrf in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- sgx-dcap-quote-verify-python (PyPI): affected all versions; fixed in 0.0.3\n- sgx-dcap-quote-verify-python (PyPI): affected all versions; fixed in 0.0.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-344m-qcjq-xgrf/ (Markdown: https://insights.sbomify.com/GHSA-344m-qcjq-xgrf/index.md)","id":"GHSA-344m-qcjq-xgrf","markdown":"https://insights.sbomify.com/GHSA-344m-qcjq-xgrf/index.md","name":"GHSA-344m-qcjq-xgrf","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Python SGX verification library","requires_auth":"none","summary":"An attacker can read memory or cause denial of service by exploiting a vulnerable OpenSSL dependency in the SGX quote verification library.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"sgx-dcap-quote-verify-python includes a statically linked copy of OpenSSL. The version of OpenSSL included in sgx-dcap-quote-verify-python 0.0.1..0.0.2 is vulnerable to a security issue. More details about the OpenSSL vulnerabilities themselves can be found at https://www.openssl.org/news/secadv/20230207.txt.\n\n## Analysis\nThe binding includes OpenSSL version 1.1.1s which is vulnerable to the vulnerabilities disclosed in [OpenSSL Security Advisory from the 7th February 2023](https://www.openssl.org/news/secadv/20230207.txt).\nThe binding does not directly use OpenSSL. The binding calls the SGX Quote Verification Library which uses OpenSSL.\n\n## Explanation\nThe SGX Quote Verification Library uses OpenSSL as a dependency to perform its cryptographic operations and certificate verification.\n\nThe OpenSSL security advisory mentions multiple vulnerabilities but I believe the most concerning would be CVE-2023-0286 “X.400 address type confusion in X.509 GeneralName”. Its severity is rated high and the advisory states that “this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.”\n\nRelying on CRLs obtained from an untrusted party is exactly what can happen when verifying a quote. For instance, the vulnerability could be triggered through the \"sgx_qv_verify_quote\" function which can take untrusted quote collateral as input. The quote collateral contains a CRL and certificate chains. The Quote Verification Library uses OpenSSL to verify the validity of those in order to establish the authenticity of the quote. Thus the vulnerability could be exploited with corrupted/forged collateral and quote.\n\n## Impact\n\nAccording to the advisory the \"vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service\". Transitively I expect the same to be true for the Quote Verification Library.\nThe denial of service impact is not much of a concern I believe since processing forged collateral would most likely stop the software from proceeding normally anyway (forged collateral should be rejected). The part regarding the ability to read memory contents, could result in information disclosure which is a real concern. The quote verification happens on the relying party end, which might use it to check enclave authenticity before providing sensitive data, this vulnerability could therefore result in the leakage of sensitive data.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Vulnerable OpenSSL included in sgx-dcap-quote-verify-python","id":"GHSA-344m-qcjq-xgrf","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"memory_corruption","year":"2023"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.0.3"],"introduced":["0"],"last_affected":[],"package":"sgx-dcap-quote-verify-python","purl":null,"source":"GHSA-344m-qcjq-xgrf"},{"ecosystem":"PyPI","fixed":["0.0.3"],"introduced":["0"],"last_affected":[],"package":"sgx-dcap-quote-verify-python","purl":"pkg:pypi/sgx-dcap-quote-verify-python","source":"GHSA-344m-qcjq-xgrf"}],"products":null,"published":"2023-02-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can read memory or cause denial of service by exploiting a vulnerable OpenSSL dependency in the SGX quote verification library.","url":"https://insights.sbomify.com/GHSA-344m-qcjq-xgrf/"}